PT-2021-18557 · Mozilla+1 · Firefox+1

Wladimir Palant

·

Published

2021-04-20

·

Updated

2024-12-12

·

CVE-2021-29944

CVSS v3.1

6.1

Medium

VectorAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Firefox versions prior to 88
Description The issue is related to a lack of escaping, allowing HTML injection when a webpage is viewed in Reader View. Although a Content Security Policy prevents direct code execution, HTML injection is still possible. This issue only affects Firefox for Android, with other operating systems being unaffected.
Recommendations For versions prior to 88, update to version 88 or later to resolve the issue.

Fix

XSS

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2021-1676
ALT-PU-2021-2725
ALT-PU-2021-2881
ALT-PU-2021-3368
ALT-PU-2021-3369
ALT-PU-2022-1781
ALT-PU-2022-1782
CVE-2021-29944
OESA-2023-1673
OESA-2023-1674
OPENSUSE-SU-2024:10600-1
OPENSUSE-SU-2024:14572-1

Affected Products

Alt Linux
Firefox